Move command fails with "disallowed value(s)" when b13/container rewrites simple commands to paste commands without colPos

[imminger]

When b13/container is installed alongside content_defender, moving content elements via the list module (up/down arrows) fails with:

The command "move" for record "..." couldn't be executed due to disallowed value(s).

Steps to reproduce

1. Install b13/container and content_defender
2. Configure two different backend layouts with different allowed CTypes (e.g. "Homepage" allows only textpic, "Subpage" allows text)
3. Create a page using the "Subpage" backend layout
4. Add a content element with a CType that is allowed on "Subpage" but not on "Homepage" (e.g. text)
5. Open the page in the list module
6. Try to move the element up or down using the sorting arrows
7. The move fails with "disallowed value(s)"

Note: The same move works fine via drag & drop in the page module.

Root cause

b13/container rewrites all simple move commands (e.g. ['move' => -12345]) into paste commands in its CommandMapBeforeStartHook::rewriteSimpleCommandMap(). For elements that have no relation to containers, the resulting command looks like:

['move' => 
    [
        'action' => 'paste', 
        'target' => -12345, 
        'update' => []
    ]
];

In CmdmapDataHandlerHook::processCmdmap_beforeStart() (line 64-75), the code checks:

if (is_array($value)
    && !empty($value['action'])
    && 'paste' === $value['action']
    && isset($value['update']['colPos'])  // <-- false, because update is empty
) {
    $command = 'paste';
    $pageId = (int)$value['target'];
    $colPos = (int)$value['update']['colPos'];
} else {
    $pageId = (int)$value;  // <-- (int) on an array = 1 in PHP
    $colPos = (int)$currentRecord['colPos'];
}

Since update is empty, isset($value['update']['colPos']) is false. The code falls into the else branch where (int)$value casts the array to 1. This causes content_defender to resolve the backend layout for page ID 1 (root page) instead of the actual page. The error occurs when the element's CType is not in the allowed list for page ID 1's backend layout — even though it is perfectly valid on the page where the move is actually happening.

This is not a bug in content_defender itself (without b13/container installed, everything works as expected). Since both extensions are widely used in the TYPO3 ecosystem, it would be great if this issue can be fixed.

Environment

• TYPO3 13.4.27
• content_defender 3.5.3
• b13/container 3.2.3 (3.2.2 works fine)